基于资产相关性的信息系统安全评估模型  

Model of information system security evaluation based on assets association degree

作　　者：周景贤[1] 王帅卿 韩迎亚 顾兆军[1,2] 

机构地区：[1]中国民航大学信息安全测评中心,天津300300 [2]中国民航大学计算机科学与技术学院,天津300300 [3]中国消费者报社,北京100048

出　　处：《计算机工程与设计》2017年第7期1691-1696,1718,共7页Computer Engineering and Design

基　　金：民航科技基金项目(MHRD20140205;MHRD20150233);国家自然科学基金项目(61303232);中央高校基金项目中国民航大学专项基金项目(3122013C004;3122015D025);中国民航大学科研启动基金项目(2013QD24X)

摘　　要：针对只考虑单资产风险的评估不能客观反映信息系统真实安全水平的问题,提出一种基于资产相关性的信息安全风险评估模型。分析资产与资产、资产与业务关系,建立资产关系模型;采用粗糙集属性重要度概念,对决定资产价值的安全属性进行权重分配,计算各个资产价值;基于资产相关性,融合资产的威胁、脆弱性和已有安全措施,计算信息系统的风险值。实例验证结果表明,基于资产相关性的风险值计算结果与信息系统面临的实际风险相一致,与传统计算模型比较结果显示,所提模型在反映信息系统安全水平方面更为客观合理。In view of the problem that single asset risk assessment can not reflect the real security level of information system,an information security risk assessment model based on asset correlation was proposed.Analysis was conducted on the relations assets and assents,assets and business,and an assets relation model was built.The concept of rough set attribute importance degree was used to determine the security attributes of the asset value,and each asset value was calculated.Based on the correlation between the assets,combining assets threat,vulnerability and the existing security measures,the information system risk value was calculated.Examples show that the calculation results of risk value based on asset correlation are consistent with the actual risk of information system.Compared with the traditional calculation model,the results show that the proposed model is more objective and reasonable to reflect the security level of information system.

关 键 词：资产 相关性程度 信息系统 粗糙集 风险评估 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]